Sality botnet takedown plans posted online

Updated A self-describer "law-abiding citizen" has posted attack plans against the Sality botnet on the Full Disclosure security mailing list, along with a tongue-in-cheek warning not to enact them since that would be illegal.

"It has come to my attention that it is not only possible but easy to seize control of version three of the botnet, and, more importantly, take it down. Sadly, doing so would require breaking the law. For this reason, I have to request that nobody perform the steps I am about describe," the author says, with more than a hint of irony.

The details of the plan are in an online archive and contain SQL injection tools that can be used to add a copy of an encrypted version of the AVG Sality removal utility into the botnet. It also has a Python script that, the author claims, will get an updated list of targets from the botnet's P2P network. The author also suggests the paranoid should open the file via a locked down virtual system to avoid any possibility that this is a hoax designed to infect security researchers.

The posted plans are for attacking version three of the Sality code, but security companies report the botnet controllers have already started to upgrade to a new version, so even if the attack works, the effect would be muted. The current version installs a keylogger, VoIP cracking tools, spam relays, and some experimental malware combinations

The Sality botnet is one of the bigger botnets, thought to be about the same size as Rostock, and was first spotted in June 2003, according to a recent a white paper from Symantec. It was apparently named after the Russian town of “Salavat City”, although the command and control servers are thought to be in the US, UK, and the Netherlands.

There are removal tools out there for it, but some people aren't using them. In terms of its hosts, Symantec reports over a fifth of the infected PCs that form the botnet are in Romania, with Brazil and India the next most common. ®

Update

An examination of the exploit package posted on Full Disclosure suggests it could work at taking down the Sality botnet, but could also be used to take it over and use it for other purposes.

"From what I've read, the attack looks valid, and if performed it's likely that they would work – but whether it would be an efficient takedown or just give the operators a blip in the system I'm not sure," Liam O Murchu, manager of operations for Symantec's Security Response team, told The Register.

The attack seeks to inject a virus cleaning system into the botnet, essentially ordering it to wipe itself, but this isn't necessarily the payload that could be used he warned. If someone scripted their own attack code then it would be possible to take over those machines in the botnet and use then for any purpose. Stealing machines in this way is an increasingly common tactic in the malware industry he said.

While there's no way of knowing how many of the machines in the Sality botnet are still using the vulnerable version three of the malware, he cautioned about users taking the law into their own hands and attacking the botnet. The potential knock on effects to infected systems and networks could be large and this kind behavior has often caused more trouble than it solved in the past.